Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-72780Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeyPackagist · craftcms/cms · fixed in 5.10.5
- CVE-2026-72779Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObjectPackagist · craftcms/cms · fixed in 5.10.6, 4.18.2
- CVE-2026-72778Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configPackagist · craftcms/cms · fixed in 5.10.6, 4.18.2
- CVE-2026-72775n8n before 1.123.67 SQL Injection via PostgresTrigger Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72774n8n before 1.123.67 Authentication Bypass via HTTP Request Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72773n8n before 2.32.1 Path Traversal via computer-use search_filesnpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72772n8n before 2.32.1 Authentication Bypass via Token Exchangenpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72771n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodesnpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72770n8n before 1.123.67 Path Traversal via Git Node Operationsnpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72769n8n before 1.123.67 Prototype Pollution via VM Expression Enginenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72768n8n before 2.32.1 SSRF Protection Bypass via MCP Clientnpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72767n8n before 1.123.67 Remote Code Execution via Git nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72766n8n before 1.123.67 Arbitrary File Read via Send Email Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72765n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escapenpm · n8n · fixed in 2.32.1, 2.31.5
- CVE-2026-72764n8n before 1.123.67 Module Cache Poisoning via Code Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72763n8n before 1.123.67 Credential Exfiltration via Sub-Workflownpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72762n8n before 1.123.67 Arbitrary File Write via Edit Image Nodenpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72750n8n before 1.123.67 SQL Injection via executeQuery Operationnpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72749n8n before 1.123.67 Prototype Pollution via Edit Fieldsnpm · n8n · fixed in 1.123.67, 2.32.1, 2.31.5
- CVE-2026-72744Nuxt before 4.5.1 Information Disclosure via Chrome DevToolsnpm · nuxt · fixed in 4.5.1, 3.21.10
- CVE-2026-19418TYPO3 CMS - Broken Access Control in Backend and Install ToolPackagist · typo3/cms-backend, typo3/cms-core · fixed in 13.4.34, 14.3.6
- CVE-2026-58230Multiple vulnerabilities in SAP Business AI Platform (Approuter)npm · @sap/approuter · fixed in 23.0.0
- CVE-2026-18948Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverPyPI · feast · fixed in 0.67.0
- CVE-2026-69112Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_mapPyPI · accelerate
- CVE-2026-68872Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or VariablePyPI · apache-airflow-providers-amazon · fixed in 9.34.0
- CVE-2026-68871Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or VariablePyPI · apache-airflow-providers-yandex · fixed in 4.5.1
- CVE-2026-48048XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requestsMaven · org.xwiki.platform:xwiki-platform-livetable-ui · fixed in 16.10.17, 17.4.9, 17.10.3
- CVE-2026-28672Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilderMaven · org.apache.ranger:ranger
- CVE-2026-12570Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/kerasPyPI · keras · fixed in 3.15.0
- CVE-2026-12372Server-Side Request Forgery (SSRF) in nltk/nltkPyPI · nltk · fixed in 3.10.0